Received: by 2002:a25:ab43:0:0:0:0:0 with SMTP id u61csp1032706ybi; Fri, 21 Jun 2019 12:28:36 -0700 (PDT) X-Google-Smtp-Source: APXvYqxbr3Da9FTTTuIwWTcYLt6tk5ndbcCJESxXOsdITDv7kISkEJxMnHknTLToEybxWuFQA9/1 X-Received: by 2002:a17:90a:2ec2:: with SMTP id h2mr8733413pjs.119.1561145316087; Fri, 21 Jun 2019 12:28:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1561145316; cv=none; d=google.com; s=arc-20160816; b=a8blcbG9clFz7U8B9K9A6sA3BKlVkvdO8tgKp1y8nxji2kEiFPvCbWYN+kiRGWjmYx t73lYhs08Nz/jHKz2Hl49esNGlu8FbyZqVe8eKAnan0nzlntksAh7m0K/7Vaq6mCtCto IdhQ5kREHIJ3eFKiOl7qwnzdX31grQGthXxO7r5UmB+8Ct9drEYDHHhSgkl1CmQzUM/N Qx6xgwNxNJb+Ggyj5fiR5jz8wMjbpim7VpgSJ9CNHFFkYVt5LfaxmPFAG06bTiVtJlzH tEkepYahitlC6PNr1ZRWaGbk1SyzMOpR2lBFevM6hq9bDuBmssmk7LrNgxVuy9i7ftSd Wacg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=vgNmp5vgEU3rAhixaVZBAVG/jZQe0nnZZmn89Y6ROOU=; b=feYTlKkAl52aSOaHzZHThlLU0fdLcNWdPupvv1zWMSbxan2CGjaDF3JckqAU2+ZfE6 R1gGxWPPFsUTMndIU26jfl/wNa5vRhIm5HsM6eX/Sk4CiAuInn2A5K2B9GqHl9P5LhzD SSXUdnKnJvTyB7k3mRB6mA+xGAdihsiwM8DExHxoxofweRA/jgbTG8vQMO3E3obSELtP EflmpF566hUhzCAZFY3GtpCAhBPMHmz6Q+zqEy2IpRKVBk3nPwjy6zLJM2RgQUgH942y aEVOCH/jzJc8Uk8r1PpnxopaAQiJ4E/C+FCNwEw79eIdpSGnjXuHqGfIKPP+Il/T0naP lbjw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=PMBL5EB9; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id e65si3603021pfe.46.2019.06.21.12.28.20; Fri, 21 Jun 2019 12:28:36 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=PMBL5EB9; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726045AbfFUT17 (ORCPT + 99 others); Fri, 21 Jun 2019 15:27:59 -0400 Received: from mail-io1-f68.google.com ([209.85.166.68]:35135 "EHLO mail-io1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725947AbfFUT16 (ORCPT ); Fri, 21 Jun 2019 15:27:58 -0400 Received: by mail-io1-f68.google.com with SMTP id m24so209219ioo.2 for ; Fri, 21 Jun 2019 12:27:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vgNmp5vgEU3rAhixaVZBAVG/jZQe0nnZZmn89Y6ROOU=; b=PMBL5EB9hYeXfWjwjHLH+cq/MAI59cWGMboU3RV/osmS7BQI4sRYs6aYaTanGlalHX tIpSCrVAj7AQa5/F4xZHrX9VASbjutks5ySA6mYQq2NX0iSEfvgeuT0I9i9MG/tOxb1A bP60UPJDIQNxjOElRHl7AjJh1ttBX+0C3Z3DYehZsJO2Il9Pme+wAeHTftopa2Af9t9+ MvCW90YoMiv0MB6oLhnacMv/hvgXnw4fHeVw8v5dEFs6qGsEiVEstqKdhE+IaCXoG3xT XREfXN82lzggbYkTcpkev7sXPFUmZsZk9lX3ILxYTnrRuCmjoneT7UI1Z3SuCdAOZT6z p9qA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vgNmp5vgEU3rAhixaVZBAVG/jZQe0nnZZmn89Y6ROOU=; b=SwBy11GJ8PX+crsbcwjtwBXfdus6BGo1Z6fZDcHviLmNbdB9Lz75PIPz4CZCT0Xkm8 depUkHSvjY2UkAJdGm4luamsDv5JTT/FMFpnOOxddIPIN3MeGVRwE1flUInbMfe6fOeM Z+VNsdzhP/1g1SdW80GeHoV3Ir+s0X9z87dkpyaK9hRcwflY5qi50cZF6uUa+YG61vJM 5koHyI0ND9Mg2Srk71GQvPTRrE23wePiQF7ZjwDu5QqoeSEGwrEfptaC6Mw40Pw/jRBO +bNoHN2IY125FE3sDZopGaYIgUnUAEZjg7WNX26Un27VTpvOlth7Pu42nVpMiYPksZOC qzJQ== X-Gm-Message-State: APjAAAV/Wkv6MhH9rcbQe0OWsgFWv5BQaGPQI/Al5vwkRYJa3bcBgw/i u1AeWjhA/CBMf5jxA5UL7JH+FcYLTBt465/6wdZYjw== X-Received: by 2002:a6b:8dcf:: with SMTP id p198mr36443852iod.46.1561145277675; Fri, 21 Jun 2019 12:27:57 -0700 (PDT) MIME-Version: 1.0 References: <20190621011941.186255-1-matthewgarrett@google.com> <20190621011941.186255-2-matthewgarrett@google.com> In-Reply-To: From: Matthew Garrett Date: Fri, 21 Jun 2019 12:27:46 -0700 Message-ID: Subject: Re: [PATCH V33 01/30] security: Support early LSMs To: Andy Lutomirski Cc: James Morris , linux-security@vger.kernel.org, LKML , Linux API Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jun 20, 2019 at 10:23 PM Andy Lutomirski wrote: > > On Thu, Jun 20, 2019 at 6:22 PM Matthew Garrett > wrote: > > > > The lockdown module is intended to allow for kernels to be locked down > > early in boot - sufficiently early that we don't have the ability to > > kmalloc() yet. Add support for early initialisation of some LSMs, and > > then add them to the list of names when we do full initialisation later. > > I'm confused. What does it even mean to lock down the kernel before > we're ready to run userspace code? We can't possibly be attacked by > user code before there is any to attack us. Certain kernel parameters can be disabled by lockdown, so we want to have policy available before that parsing happens.